Supported Cipher Suites

Cipher suites are cipher combinations that are used to negotiate security settings during the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handshake.

Make sure you verify the correct cipher settings with your security team, and update your eCDN zone cipher suite settings based on your security requirements.

The following SCAPI eCDN endpoints retrieve and restrict the available TLS cipher suites that browsers and devices are allowed to use when accessing a customer’s website/hostname that is served by a specified zone:

• getCipherSuites
• updateCipherSuites

Modern cipher suites offer the best security and performance by limiting your clients to modern devices and browsers. All modern cipher suites use forward secrecy encryption and support authenticated encryption (AEAD).

The following Modern cipher suites are supported:

• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-ECDSA-CHACHA20-POLY1305
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-CHACHA20-POLY1305
• ECDHE-ECDSA-AES256-GCM-SHA384
• ECDHE-RSA-AES256-GCM-SHA384

Compatible cipher suites provide broader compatibility with support for additional cipher suites:

• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-ECDSA-CHACHA20-POLY1305
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-CHACHA20-POLY1305
• ECDHE-ECDSA-AES256-GCM-SHA384
• ECDHE-RSA-AES256-GCM-SHA384,
• ECDHE-ECDSA-AES128-SHA256
• ECDHE-RSA-AES128-SHA256
• ECDHE-ECDSA-AES256-SHA384
• ECDHE-RSA-AES256-SHA384

Legacy cipher suites include all cipher suites that our eCDN partners support. By default, these legacy cipher suites are selected, because this provides the broadest compatibility for customer implementations, although it includes some weaker ciphers.

The getCipherSuites endpoint returns a cipherSuiteType of Legacy and an empty cipher suite array, which means that the following default legacy cipher suites are used:

• AEAD-AES128-GCM-SHA256
• AEAD-AES256-GCM-SHA384
• AEAD-CHACHA20-POLY1305-SHA256
• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-ECDSA-CHACHA20-POLY1305
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-CHACHA20-POLY1305
• ECDHE-ECDSA-AES256-GCM-SHA384
• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-ECDSA-AES128-SHA256
• ECDHE-RSA-AES128-SHA256
• ECDHE-ECDSA-AES256-SHA384
• ECDHE-RSA-AES256-SHA384
• ECDHE-ECDSA-AES128-SHA
• ECDHE-RSA-AES128-SHA
• AES128-GCM-SHA256
• AES128-SHA256
• AES128-SHA
• ECDHE-RSA-AES256-SHA
• AES256-GCM-SHA384
• AES256-SHA256
• AES256-SHA
• DES-CBC3-SHA

To combine or specify a set of cipher suites that you want to allow, use the updateCipherSuites endpoint to specify the custom cipher suites that you want to support and set cipherSuiteType to Custom. When you set cipherSuiteType to Custom, you must specify a minimum of 5 valid ciphers.

If you require TLS 1.3 for HTTPS connections, you must first enable TLS 1.3 connections to be accepted in your zone using the Business Manager crypto settings of the zone or using the updateSecuritySettings endpoint. This automatically enables the following ciphers:

• AEAD-AES128-GCM-SHA256 (IANA name: TLS_AES_128_GCM_SHA256)
• AEAD-AES256-GCM-SHA384 (IANA name: TLS_AES_256_GCM_SHA384)
• AEAD-CHACHA20-POLY1305-SHA256 (IANA name: TLS_CHACHA20_POLY1305_SHA256)

• What cipher suites are needed for Payment Card Industry Data Security Standard (PCI DSS) compliance?
  • The following cipher suites are recommended for PCI DSS compliance. Check with your security team to verify compliance with your site's security requirements.
    • ECDHE-ECDSA-AES128-GCM-SHA256
    • ECDHE-RSA-AES128-GCM-SHA256
    • ECDHE-ECDSA-AES256-GCM-SHA384
    • ECDHE-RSA-AES256-GCM-SHA384
    • ECDHE-ECDSA-CHACHA20-POLY1305
    • ECDHE-RSA-CHACHA20-POLY1305
• How can I disable weak cipher suites listed in the SSL Labs weak ciphers report?
  • To disable weak ciphers listed in a Qualys SSL Labs report:
    1. Use the previous table to get the corresponding cipher suite information.
    2. Identify which cipher suites you want to allow.
    3. Use the updateCipherSuites endpoint to specify the custom cipher suites that you want to update and set cipherSuiteType to Custom for the applicable zone.
• What is the order in which cipher suites are used?
  • ECDSA cipher suites are prioritized over RSA, and then cipher suites are condered in the order they were set. This means that, if both ECDSA and RSA are used, Cloudflare presents the ECDSA ciphers first in the order they were set. Then the RSA ciphers are presented in the order they were set.
• Why am I getting the ERR_SSL_VERSION_OR_CIPHER_MISMATCH cipher suite mismatch error when visiting my site?
  • Ensure that the certificate is compatible with the chosen cipher suites for your zone. For example, if you upload an RSA certificate, your cipher suite selection cannot specify support for only ECDSA certificates.